CVE-2022-48935

In the Linux kernel, the following vulnerability has been resolved:

netfilter: nf_tables: unregister flowtable hooks on netns exit

Unregister flowtable hooks before they are releases via nftablesflowtable_destroy() otherwise hook core reports UAF.

BUG: KASAN: use-after-free in nfhookentries_grow+0x5a7/0x700 net/netfilter/core.c:142 net/netfilter/core.c:142 Read of size 4 at addr ffff8880736f7438 by task syz-executor579/3666

CPU: 0 PID: 3666 Comm: syz-executor579 Not tainted 5.16.0-rc5-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 Call Trace: <TASK> _dumpstack lib/dumpstack.c:88 [inline] _dumpstack lib/dumpstack.c:88 [inline] lib/dumpstack.c:106 dumpstacklvl+0x1dc/0x2d8 lib/dumpstack.c:106 lib/dumpstack.c:106 printaddressdescription+0x65/0x380 mm/kasan/report.c:247 mm/kasan/report.c:247 _kasanreport mm/kasan/report.c:433 [inline] _kasanreport mm/kasan/report.c:433 [inline] mm/kasan/report.c:450 kasanreport+0x19a/0x1f0 mm/kasan/report.c:450 mm/kasan/report.c:450 nfhookentriesgrow+0x5a7/0x700 net/netfilter/core.c:142 net/netfilter/core.c:142 _nfregisternethook+0x27e/0x8d0 net/netfilter/core.c:429 net/netfilter/core.c:429 nfregisternethook+0xaa/0x180 net/netfilter/core.c:571 net/netfilter/core.c:571 nftregisterflowtablenethooks+0x3c5/0x730 net/netfilter/nftablesapi.c:7232 net/netfilter/nftablesapi.c:7232 nftablesnewflowtable+0x2022/0x2cf0 net/netfilter/nftablesapi.c:7430 net/netfilter/nftablesapi.c:7430 nfnetlinkrcvbatch net/netfilter/nfnetlink.c:513 [inline] nfnetlinkrcvskbbatch net/netfilter/nfnetlink.c:634 [inline] nfnetlinkrcvbatch net/netfilter/nfnetlink.c:513 [inline] net/netfilter/nfnetlink.c:652 nfnetlinkrcvskbbatch net/netfilter/nfnetlink.c:634 [inline] net/netfilter/nfnetlink.c:652 nfnetlink_rcv+0x10e6/0x2550 net/netfilter/nfnetlink.c:652 net/netfilter/nfnetlink.c:652

_nftreleasehook() calls nftunregisterflowtablenethooks() which only unregisters the hooks, then after RCU grace period, it is guaranteed that no packets add new entries to the flowtable (no flow offload rules and flowtable hooks are reachable from packet path), so it is safe to call nfflowtablefree() which cleans up the remaining entries from the flowtable (both software and hardware) and it unbinds the flow_block.